Security Engineering

Q1. What is a vulnerability in software?

1. A.A software defect fix and patch release and update
2. B.A specific automated test case and scenario and script
3. C.An intended software feature and product capability
4. D.A weakness that can be exploited to compromise security✓ Correct

Report an error in this question

Q2. What is encryption?

1. A.Authentication in the engineering discipline for effective project outcomes
2. B.Converting data into a coded form to prevent unauthorized access✓ Correct
3. C.Compression in all development efforts by the project team members
4. D.Decryption and related components to achieve project objectives

Report an error in this question

Q3. What is a firewall?

1. A.A type of computer virus or malware threat and attack during implementation
2. B.A general-purpose programming language tool and system for quality purposes
3. C.A physical wall constructed of fire bricks and mortar in the system context
4. D.A network security device that monitors and controls incoming and outgoing traffic✓ Correct

Report an error in this question

Q4. What is a security threat?

1. A.A scheduled software update release event and launch as part of the methodology
2. B.A formal source code peer review session and meeting during the software lifecycle
3. C.A potential cause of an unwanted incident that may result in harm to a system✓ Correct
4. D.A new feature request from stakeholders and clients in the development process

Report an error in this question

Q5. What is cross-site scripting (XSS)?

1. A.An attack where malicious scripts are injected into web pages viewed by other users✓ Correct
2. B.A JavaScript library for DOM manipulation and events throughout the project
3. C.A CSS framework for styling web content and layouts for the development team
4. D.A source code implementation coding technique and tool within the project scope

Report an error in this question

Q6. What is authentication?

1. A.Verifying the identity of a user or system✓ Correct
2. B.Encryption within the system boundary
3. C.Firewall configuration by the development process
4. D.Authorization according to best practices

Report an error in this question

Q7. What is SQL injection?

1. A.A database installation and setup procedure and guide
2. B.An attack that inserts malicious SQL code into application queries✓ Correct
3. C.A scheduled database backup and restore job and task
4. D.A standard SQL database query feature and capability

Report an error in this question

Q8. What is authorization?

1. A.Encryption over the entire lifecycle as defined by standards
2. B.Authentication and its related activities
3. C.Determining what permissions an authenticated user has✓ Correct
4. D.Decryption for all project stakeholders within the given

Report an error in this question

Q9. What is software security?

1. A.Locking the physical computer server room and door across all phases
2. B.Using strong passwords for user accounts only ever for the project goals
3. C.Protecting software from unauthorized access, use, modification, and destruction✓ Correct
4. D.Installing antivirus software applications only ever in a systematic way

Report an error in this question

Q10. What is HTTPS?

1. A.A general-purpose programming language type and tool in practice typically
2. B.A specific type of database storage system and service as a standard approach
3. C.A comprehensive software testing framework and tool set by the organization
4. D.HTTP Secure — a protocol for secure communication over a network using encryption✓ Correct

Report an error in this question

Q11. What is defense in depth?

1. A.A security approach using multiple layers of security controls throughout a system✓ Correct
2. B.Defending only the database from attacks and threats within the given constraints
3. C.Having one single strong defense mechanism and barrier for all project stakeholders
4. D.A military strategy used only in warfare and battles as defined by standards

Report an error in this question

Q12. What is input validation?

1. A.Accepting all user input without any validation checks by the development process
2. B.Validating only system output and response data values and its related activities
3. C.Testing user interface elements for usability and flow over the entire lifecycle
4. D.Checking and sanitizing user input to prevent malicious data from entering the system✓ Correct

Report an error in this question

Q13. What is the OWASP Top 10?

1. A.A popular music chart and ranking system and listing
2. B.A list of the ten most critical web application security risks✓ Correct
3. C.An established coding standard and guideline and rule
4. D.A comprehensive software testing framework tool and set

Report an error in this question

Q14. What is a buffer overflow?

1. A.Having too much data stored in a buffer data area for the project goals
2. B.A database table overflow and storage issue and error within the system boundary
3. C.A vulnerability where data written beyond a buffer's boundary can overwrite adjacent memory✓ Correct
4. D.A network traffic overflow and congestion issue event according to best practices

Report an error in this question

Q15. What is the CIA triad in security?

1. A.A government intelligence agency abbreviation and name as part of the methodology
2. B.An established coding standard and guideline and rule set in the development process
3. C.Confidentiality, Integrity, and Availability — the three core principles of information security✓ Correct
4. D.A comprehensive software testing framework and tool suite during the software lifecycle

Report an error in this question

Q16. What is secure coding?

1. A.Writing code in a physically secure room and building
2. B.Encrypting all application source code files and folders
3. C.Development practices that protect software from security vulnerabilities✓ Correct
4. D.Using complex passwords directly in application code

Report an error in this question

Q17. What is penetration testing?

1. A.Physical building break-in testing attempt and effort
2. B.Database query performance testing and benchmarking
3. C.Network communication speed testing and measurement
4. D.Simulating cyberattacks to identify security vulnerabilities in a system✓ Correct

Report an error in this question

Q18. What is a denial-of-service (DoS) attack?

1. A.A specific type of computer virus or malware and threat in the engineering discipline
2. B.Denying customer service requests politely and kindly to achieve project objectives
3. C.An attack that overwhelms a system with traffic to make it unavailable to users✓ Correct
4. D.A network configuration and setup procedure and process for effective project outcomes

Report an error in this question

Q19. What is a security audit?

1. A.A financial accounting audit process and procedure type in all development efforts
2. B.A systematic evaluation of a system's security by examining compliance with security policies✓ Correct
3. C.A system performance load test execution and run process and related components
4. D.A formal source code peer review session and process only by the project team members

Report an error in this question

Q20. What is the principle of least privilege?

1. A.Maximum access permissions for all system users always across all phases
2. B.No access permissions for any user in the system ever in a systematic way
3. C.Users should only have the minimum access rights necessary to perform their tasks✓ Correct
4. D.Giving everyone full administrator access to everything at every stage

Report an error in this question

Q21. What is threat modeling?

1. A.Creating detailed threat assessment reports and summaries for the development team
2. B.A systematic approach to identifying, quantifying, and addressing security threats to a system✓ Correct
3. C.Modeling threats in three-dimensional space and models within the project scope
4. D.A specific type of software testing approach and method throughout the project

Report an error in this question

Q22. What is a zero-day vulnerability?

1. A.A vulnerability that is only one day old at most today within the system boundary
2. B.A previously unknown vulnerability that is exploited before a patch is available✓ Correct
3. C.A vulnerability with absolutely zero impact on the system according to best practices
4. D.A vulnerability that was fixed on day zero of discovery for the project goals

Report an error in this question

Q23. What is the STRIDE threat model?

1. A.A source code implementation coding framework and library for quality purposes in practice typically
2. B.A comprehensive software testing model and approach only as a standard approach by the organization
3. C.A threat classification model: Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege✓ Correct
4. D.A physical walking gait analysis technique and method in the system context during implementation

Report an error in this question

Q24. What is a Common Vulnerabilities and Exposures (CVE)?

1. A.A standardized system for identifying and naming publicly known cybersecurity vulnerabilities✓ Correct
2. B.A comprehensive software testing framework and tool suite for effective project outcomes
3. C.An established coding standard and guideline and rule set in the engineering discipline
4. D.A specific type of computer virus or malware and threat to achieve project objectives

Report an error in this question

Q25. What is the concept of 'security by design'?

1. A.Integrating security considerations into every phase of the software development lifecycle✓ Correct
2. B.Designing security logos and brand imagery and assets at every stage
3. C.Adding security features only after deployment to production across all phases
4. D.Writing security documentation exclusively and nothing else in a systematic way

Report an error in this question

Q26. What is the concept of 'attack surface'?

1. A.The physical surface of a computer case and housing as part of the methodology
2. B.A network configuration and topology setup and structure during the software lifecycle
3. C.A specific type of user interface design and layout only in the development process
4. D.The total number of points where an unauthorized user can try to enter or extract data✓ Correct

Report an error in this question

Q27. What is the DREAD risk assessment model?

1. A.A comprehensive software testing model and approach only and its related activities
2. B.An established coding standard and guideline and rule set over the entire lifecycle
3. C.An assessment of fear and dread feelings and emotions by the development process
4. D.A model rating threats by Damage, Reproducibility, Exploitability, Affected users, Discoverability✓ Correct

Report an error in this question

Q28. What is secure software development lifecycle (SSDLC)?

1. A.A comprehensive software testing lifecycle and approach for all project stakeholders
2. B.A production deployment lifecycle plan and schedule doc within the given constraints
3. C.An approach that integrates security practices into each phase of the traditional SDLC✓ Correct
4. D.A brand new programming language created from scratch as defined by standards

Report an error in this question

Q29. What is the difference between symmetric and asymmetric encryption?

1. A.Asymmetric encryption uses only one single key for all by the project team members
2. B.The two encryption types are fundamentally the same thing in all development efforts
3. C.Symmetric encryption uses two different keys always now and related components
4. D.Symmetric uses the same key for encryption and decryption; asymmetric uses a key pair✓ Correct

Report an error in this question

Q30. What is the principle of 'fail secure' vs 'fail open'?

1. A.The two concepts are fundamentally identical in all ways within the project scope
2. B.Fail secure allows all access on any failure or error event throughout the project
3. C.Fail open is always the more secure approach and method for the development team
4. D.Fail secure denies access by default on failure; fail open allows access on failure✓ Correct

Report an error in this question